Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and…
Priority CRITICAL 86CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting, SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79 and CWE-89.
Summary
Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.70578 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:*:*:*:* | before 12.2 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.2:build12200:*:*:*:*:*:* | 12.2 build12200 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_pam360:*:*:*:*:*:*:*:* | before 5.8 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_pam360:5.8:build5800:*:*:*:*:*:* | 5.8 build5800 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_access_manager_plus:*:*:*:*:*:*:*:* | before 4.3 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:* | 4.3 build4300 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:* | 4.3 build4301 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:* | 4.3 build4302 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4303:*:*:*:*:*:* | 4.3 build4303 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4304:*:*:*:*:*:* | 4.3 build4304 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:*:*:*:* Versions before 12.2 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.2:build12200:*:*:*:*:*:* Versions 12.2 build12200 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_pam360:*:*:*:*:*:*:*:* Versions before 5.8 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_pam360:5.8:build5800:*:*:*:*:*:* Versions 5.8 build5800 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_access_manager_plus:*:*:*:*:*:*:*:* Versions before 4.3 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:* Versions 4.3 build4300 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:* Versions 4.3 build4301 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:* Versions 4.3 build4302 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4303:*:*:*:*:*:* Versions 4.3 build4303 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4304:*:*:*:*:*:* Versions 4.3 build4304 Vulnerable ·Zohocorp
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4305:*:*:*:*:*:* | 4.3 build4305 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4306:*:*:*:*:*:* | 4.3 build4306 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4307:*:*:*:*:*:* | 4.3 build4307 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4308:*:*:*:*:*:* | 4.3 build4308 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4305:*:*:*:*:*:* Versions 4.3 build4305 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4306:*:*:*:*:*:* Versions 4.3 build4306 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4307:*:*:*:*:*:* Versions 4.3 build4307 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4308:*:*:*:*:*:* Versions 4.3 build4308 Vulnerable ·Zohocorp
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-47523
- 2026-10-03 Alias added: GHSA-jw4x-gv7r-c358
References
More Zohocorp Manageengine Access Manager Plus vulnerabilities
- TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-15981 Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-21434 Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access… CVSS 3.1CRITICAL 9.8
- TI-2022-19138 Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550… CVSS 3.1CRITICAL 9.8
- TI-2022-21435 Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access… CVSS 3.1CRITICAL 9.8
- TI-2022-11635 Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-47523 · CVE Program
- CVE-2022-47523 · NVD
- FIRST EPSS
- GHSA-jw4x-gv7r-c358 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences